Oh, god, the lead is that "starts before configuration" non-issue. If you're not properly firewalled to begin with, why are you installing applications? And seriously, how hard is it to put the config file in place before installing the package instead of after it (apt won't overwrite it), if you're that damned concerned about the milliseconds of "vulnerability" between your configuration management tool installing the package and then plonking down your config and restarting it?

And if you're manually configuring your hardened servers instead of using a configuration tool, then you have significantly greater problems than 'omg! starts too early!'. And even then, if you're manually installing something and you think it's going to have a preconfig vuln, then just add '&& service thingy stop' after your install line.

Seriously, this is a vim-vs-emacs-style non-complaint, for when you can't think of any actual issues.